CVE-2026-89967: mm/migrate_device: avoid out-of-bounds writes for compound folios
In the Linux kernel, the following vulnerability has been resolved:
mm/migratedevice: avoid out-of-bounds writes for compound folios
migratedevicerange() and migratedevicepfns() clear the entries following a compound folio so that the PFN arrays retain their page-granular representation.
If a compound folio extends beyond the end of the caller-provided range, the loops clear all following folio entries without limiting them to the number of slots remaining in the npages-sized array, causing an out-of-bounds write.
Do not proceed with a compound folio if its page-granular representation does not fit entirely in the remaining PFN array. If this happens, drop any reference and lock acquired for the folio, clear the remaining entries, and stop collecting.
Observed with a KASAN x86 QEMU kernel using the HMM migrateanonhugezero selftest. Closing /dev/hmmdmirror0 after migrating an anonymous huge page to device memory exercises:
dmirrorfopsrelease() -> dmirrordeviceevictchunk() -> migratedevicerange()
Event History
Frequently Asked Questions
Which systems are most likely to exercise the vulnerable code path?
Systems using Linux HMM device-memory migration are the relevant exposure group. The issue was observed with the HMM migrate_anon_huge_zero selftest when an anonymous huge page was migrated to device memory and /dev/hmm_dmirror0 was closed.
What condition triggers the out-of-bounds write?
A compound folio must extend past the end of the caller-provided PFN array range. The affected migration routines then clear entries for the rest of the folio without first ensuring that its page-granular representation fits in the remaining array slots.
How can teams determine whether they may already be affected?
Look for use of migrate_device_range() or migrate_device_pfns() with HMM device-memory migration, particularly workflows involving compound or anonymous huge folios near the boundary of a requested PFN range. KASAN can detect the resulting out-of-bounds write in a test environment.
What is the safe behavior implemented by the resolution?
When a compound folio does not fit entirely in the remaining PFN array, migration collection stops for that folio. Any acquired folio reference and lock are released, and only the remaining array entries are cleared.